difpt.org
Open in
urlscan Pro
166.62.10.186
Malicious Activity!
Public Scan
URL:
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Submission: On May 27 via automatic, source openphish
Submission: On May 27 via automatic, source openphish
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 14 HTTP transactions.
The main IP is 166.62.10.186, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC, US.
The main domain is difpt.org.
This is the only time difpt.org was scanned on urlscan.io!
This is the only time difpt.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 166.62.10.186 166.62.10.186 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
| 1 | 185.225.208.133 185.225.208.133 | 13213 (UK2NET-AS) (UK2NET-AS) | |
| 1 | 67.202.94.86 67.202.94.86 | 32748 (STEADFAST) (STEADFAST) | |
| 14 | 4 |
12
166.62.10.186
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-10-186.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-10-186.ip.secureserver.net
| difpt.org |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
difpt.org
difpt.org |
105 KB |
| 1 |
amung.us
whos.amung.us |
212 B |
| 1 |
waust.at
waust.at |
7 KB |
| 14 | 3 |
| Domain | Requested by | |
|---|---|---|
| 12 | difpt.org |
difpt.org
|
| 1 | whos.amung.us |
waust.at
|
| 1 | waust.at |
difpt.org
|
| 14 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| whos.amung.us |
| Subject Issuer | Validity | Valid |
|---|
This page contains 3 frames:
Primary Page:
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Frame ID: 62D743CFC99F92DFADD6495CDC72331F
Requests: 13 HTTP requests in this frame
Frame:
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/wmms.svg
Frame ID: 0FB80FF977183F2530B9CE3CDB5E7603
Requests: 1 HTTP requests in this frame
Frame:
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/sig-en.svg
Frame ID: 244B0F6FD3D99C4F9EC16FE293646D7A
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://whos.amung.us/stats/k79luj4uh0/
Title: 4
Title: 4
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
authenticate.php
difpt.org/images/.cra-ca/home404shtmlccrd-request/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
82 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
theme.min.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
199 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
apps.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
d.js
waust.at/ |
13 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
timeout.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
428 B 597 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
39 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
header-leaf.jpg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
header-bg.jpg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sft-deco.gif
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ |
80 B 346 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wmms.svg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ Frame 0FB8 |
5 KB 2 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sig-en.svg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ Frame 244B |
11 KB 3 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
whos.amung.us/pingjs/ |
28 B 212 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| empty function| change object| _wau string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_cps function| docReady object| x string| x1 string| x20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
difpt.org
waust.at
whos.amung.us
166.62.10.186
185.225.208.133
67.202.94.86
204a17ca995a792e855a803a949467e09f71c1f78ed57551684cab15db078cbe
21092efadab949c3ad748e1c67c0e5f14eaab93275d2f1ba142464ef02a3735a
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
447a4a6c6d785d6fc009367d1fd835b3245114e3162a5dafe288ea54ffd7e0c7
4dd1b275548819246b29ff689c8f617314c6e7b5a18c30341c001321519f9913
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
6081e5ab192226d10d4ccbb32070bd11f65a079467886afb905ee3b9440952e7
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
76ba1dcdc4a4788b4c0230926b957bb1831dd7ccdc263983a3a4259d1f43051c
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
93c11c985807fa11dee8e93dabece88c3b74c1e945fa8911c032e75ddd2a6f2d
bc07151b5fdfed38b951a39fc41610a7b72564534e24bd18ed7e1fbc4ecbf33f
ddc04f3de34dce28968926fb8d174ad39a07b875392fa406b07fc4c729a47438
e3536ef9cb8bcff43b17377a72b2657db0d020529137688b1fdf4b2ec7a2c105